bazel: add shellcheck to //:check

Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>

bazel/ci/BUILD.bazel

@@ -1,7 +1,7 @@
 load("@bazel_gazelle//:def.bzl", "gazelle")
 load("@com_github_ash2k_bazel_tools//multirun:def.bzl", "multirun")
 load("@com_github_bazelbuild_buildtools//buildifier:def.bzl", "buildifier", "buildifier_test")
-load("//bazel/sh:def.bzl", "repo_command", "sh_template")
+load("//bazel/sh:def.bzl", "noop_warn", "repo_command", "sh_template")
 
 gazelle(name = "gazelle_generate")
 
@@ -64,6 +64,34 @@ sh_template(
     template = "shfmt.sh.in",
 )
 
+noop_warn(
+    name = "shellcheck_noop_warning",
+    warning = "Shellcheck should have been executed, but is currently not available for your platform.",
+)
+
+alias(
+    name = "com_github_koalaman_shellcheck",
+    actual = select({
+        "@io_bazel_rules_go//go/platform:darwin_amd64": "@com_github_koalaman_shellcheck_darwin_x86_64//:shellcheck_bin",
+        "@io_bazel_rules_go//go/platform:darwin_arm64": ":shellcheck_noop_warning",
+        "@io_bazel_rules_go//go/platform:linux_amd64": "@com_github_koalaman_shellcheck_linux_x86_64//:shellcheck_bin",
+        "@io_bazel_rules_go//go/platform:linux_arm64": "@com_github_koalaman_shellcheck_linux_aaarch64//:shellcheck_bin",
+    }),
+)
+
+sh_template(
+    name = "shellcheck",
+    data = [
+        ":com_github_koalaman_shellcheck",
+        "@com_github_katexochen_sh_v3//cmd/shfmt",
+    ],
+    substitutions = {
+        "@@SHELLCHECK@@": "$(rootpath :com_github_koalaman_shellcheck)",
+        "@@SHFMT@@": "$(rootpath @com_github_katexochen_sh_v3//cmd/shfmt)",
+    },
+    template = "shellcheck.sh.in",
+)
+
 repo_command(
     name = "gofumpt",
     args = [
@@ -84,7 +112,6 @@ multirun(
         ":gazelle_generate",
         ":buildifier_fix",
     ],
-    jobs = 1,  # execute sequentially
     visibility = ["//visibility:public"],
 )
 
@@ -94,7 +121,9 @@ multirun(
     commands = [
         ":gazelle_check",
         ":buildifier_check",
-    ],
-    jobs = 0,
+    ] + select({
+        "@io_bazel_rules_go//go/platform:darwin_arm64": [":shellcheck_noop_warning"],
+        "//conditions:default": [":shellcheck"],
+    }),
     visibility = ["//visibility:public"],
 )

bazel/ci/shellcheck.sh.in

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+lib=$(realpath @@BASE_LIB@@) || exit 1
+shfmt=$(realpath @@SHFMT@@) || exit 1
+shellcheck=$(realpath @@SHELLCHECK@@) || exit 1
+
+# shellcheck source=../sh/lib.bash
+if ! source "${lib}"; then
+  echo "Error: could not find import"
+  exit 1
+fi
+
+cd "${BUILD_WORKSPACE_DIRECTORY}" || exit 1
+
+scriptsStr=$(${shfmt} -f "${BUILD_WORKSPACE_DIRECTORY}")
+readarray -t <<< "${scriptsStr}"
+scripts=("${MAPFILE[@]}")
+
+excludeDirs=(
+  "cli/internal/helm/charts/cilium"
+  "build"
+)
+
+echo "The following scripts are excluded and won't be linted with shellcheck:"
+for exclude in "${excludeDirs[@]}"; do
+  for i in "${!scripts[@]}"; do
+    if [[ ${scripts[i]} == "${BUILD_WORKSPACE_DIRECTORY}/${exclude}"* ]]; then
+      echo "  ${scripts[i]}"
+      unset 'scripts[i]'
+    fi
+  done
+done
+
+echo "Linting the following scripts with shellcheck:"
+for script in "${scripts[@]}"; do
+  echo "  ${script}"
+done
+
+statuscode=0
+for file in "${scripts[@]}"; do
+  ${shellcheck} --severity=info "${file}" || statuscode=$?
+done
+
+exit "${statuscode}"

bazel/ci/shfmt.sh.in

@@ -3,7 +3,7 @@
 lib=$(realpath @@BASE_LIB@@) || exit 1
 shfmt=$(realpath @@SHFMT@@) || exit 1
 
-# shellcheck source=lib.bash
+# shellcheck source=../sh/lib.bash
 if ! source "${lib}"; then
   echo "Error: could not find import"
   exit 1
@@ -16,12 +16,15 @@ readarray -t <<< "${scriptsStr}"
 scripts=("${MAPFILE[@]}")
 
 excludeDirs=(
-  "helm/charts/cilium"
+  "cli/internal/helm/charts/cilium"
+  "build"
 )
 
+echo "The following scripts are excluded and won't be formatted with shfmt:"
 for exclude in "${excludeDirs[@]}"; do
   for i in "${!scripts[@]}"; do
-    if [[ ${scripts[i]} == *"${exclude}"* ]]; then
+    if [[ ${scripts[i]} == "${BUILD_WORKSPACE_DIRECTORY}/${exclude}"* ]]; then
+      echo "  ${scripts[i]}"
       unset 'scripts[i]'
     fi
   done

bazel/ci/tidy.sh.in

@@ -3,7 +3,7 @@
 lib=$(realpath @@BASE_LIB@@) || exit 1
 go=$(realpath @@GO@@) || exit 1
 
-# shellcheck source=lib.bash
+# shellcheck source=../sh/lib.bash
 if ! source "${lib}"; then
   echo "Error: could not find import"
   exit 1